Analysis
- max time kernel
150s - max time network
88s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 13:28
General
- Target Quantum_Notes_Berlin_6438.ps1
- Size 229KB
- Sample260715-qqt8dsgw71
- SHA256 9033bcba2be4d10ac35d712a611f1cc9c5aaa9abae6d449503d822d0923e8954
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Quantum_Notes_Berlin_6438.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2020-0-0x00007FFD1E61F000-0x00007FFD1E620000-memory.dmp
memory/2020-1-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-4-0x000001837ED30000-0x000001837ED52000-memory.dmp
memory/2020-5-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-6-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-7-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-8-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-9-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-10-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-11-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-12-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-13-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-14-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-15-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-16-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-17-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-18-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-20-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-21-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-22-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/2020-23-0x000001837F840000-0x000001837FA02000-memory.dmp
memory/2020-25-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp